blitzstrike 2.4.47 → 2.4.49

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.49] — 2026-09-14
+
+### Changed — REST permission_callback precision (traced to WP_REST_Server)
+
+- Traced WP core `class-wp-rest-server.php` dispatch: `permission_callback` is
+  OPTIONAL and defaults to PUBLIC when absent. Now distinguishes three cases:
+  missing (HIGH — forgot, defaults public), `__return_true` (MEDIUM — explicitly
+  public, the classic "commented out check_admin_permission" pattern), and a
+  real callback (skip — function/method/current_user_can).
+- Sanitizer table widened to the full `formatting.php` surface: `esc_textarea`,
+  `esc_js`, `sanitize_url`, `sanitize_title`, `sanitize_title_with_dashes`,
+  `sanitize_user`, `wp_validate_boolean`.
+
+## [2.4.48] — 2026-09-14
+
+### Changed — Precision + consistency (traced to WP core dispatch)
+
+- Grounded the authz/nonce rules in the WordPress core dispatch: `wp_ajax_*` and
+  `admin_post_*` fire ONLY when `is_user_logged_in()`, while `*_nopriv_*` fire
+  unauthenticated. `missing_authz` is now scoped to nopriv handlers that perform
+  a state-changing/privileged operation.
+- Added a DANGEROUS_OP_RE gate: `missing_nonce`/`missing_authz` only fire when
+  the handler actually performs a WRITE (option/meta/user/post/comment writes,
+  file upload/write, `$wpdb->query/insert/update/delete`, `wp_mail`, `wp_redirect`).
+  Read-only handlers (list/search/get) are no longer flagged — removes the CSRF/
+  authz false-positive storm (forminator 90→16, elementor 11→4, wp-fastest-cache
+  15→1).
+- Removed `is_admin()` / `wp_doing_ajax()` from the auth surface — they are
+  request-context checks, not authorization (treating them as auth caused false
+  negatives).
+
 ## [2.4.47] — 2026-09-14
 
 ### Changed — WordPress integration coverage is now COMPLETE (class-method + direct handlers)

package/dist/index.js

@@ -56202,6 +56202,8 @@ var SANITIZERS2 = {
   esc_attr: { context: "html_attr", level: "sanitized" },
   esc_url: { context: "url", level: "sanitized" },
   esc_url_raw: { context: "url", level: "sanitized" },
+  esc_textarea: { context: "html", level: "sanitized" },
+  esc_js: { context: "js", level: "sanitized" },
   urlencode: { context: "url", level: "sanitized" },
   rawurlencode: { context: "url", level: "sanitized" },
   wp_json_encode: { context: "json", level: "sanitized" },
@@ -56211,7 +56213,12 @@ var SANITIZERS2 = {
   sanitize_key: { context: "key", level: "validated" },
   sanitize_email: { context: "email", level: "validated" },
   sanitize_file_name: { context: "filename", level: "validated" },
-  filter_var: { context: "validated", level: "validated" }
+  sanitize_url: { context: "url", level: "validated" },
+  sanitize_title: { context: "slug", level: "validated" },
+  sanitize_title_with_dashes: { context: "slug", level: "validated" },
+  sanitize_user: { context: "username", level: "validated" },
+  filter_var: { context: "validated", level: "validated" },
+  wp_validate_boolean: { context: "validated", level: "validated" }
 };
 var PSEUDO_SANITIZERS = new Set([
   "trim",
@@ -56478,8 +56485,9 @@ function handlerName(expr) {
   return null;
 }
 var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
-var AUTH_RE = /current_user_can|is_user_logged_in|is_admin\b|is_super_admin|current_user_can_edit_post|authorize|wp_doing_ajax/;
+var AUTH_RE = /current_user_can|is_user_logged_in|is_super_admin|current_user_can_edit_post|authorize/;
 var NONCE_RE = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/;
+var DANGEROUS_OP_RE = /\b(update_option|add_option|delete_option|update_site_option|delete_site_option|update_post_meta|add_post_meta|delete_post_meta|update_user_meta|add_user_meta|delete_user_meta|update_metadata|add_metadata|delete_metadata|set_transient|delete_transient|wp_insert_post|wp_update_post|wp_delete_post|wp_trash_post|wp_untrash_post|wp_insert_comment|wp_update_comment|wp_delete_comment|wp_insert_user|wp_update_user|wp_delete_user|wp_create_user|wp_set_current_user|set_user_role|wp_set_auth_cookie|wp_mail|wp_new_user_notification|wp_handle_upload|move_uploaded_file|wp_upload_bits|wp_set_object_terms|wp_set_post_terms|wp_schedule_event|wp_clear_scheduled_hook|wp_redirect|file_put_contents|unlink|rename|wpdb->query|wpdb->insert|wpdb->update|wpdb->delete|wpdb->replace)\s*\(/;
 function detectWpAuthz(code, file, out) {
   const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
   let m;
@@ -56494,12 +56502,13 @@ function detectWpAuthz(code, file, out) {
       continue;
     const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
     const hasNonce = NONCE_RE.test(body);
+    const dangerous = DANGEROUS_OP_RE.test(body);
     const line = lineNoOf(code, m.index);
-    if (nopriv && !hasCap) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated AJAX handler '${handler}()' performs no current_user_can()/authorization check — any unauthenticated visitor can trigger it (auth bypass / privilege escalation).` });
+    if (nopriv && !hasCap && dangerous) {
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated AJAX handler '${handler}()' performs a privileged/state-changing operation with no current_user_can()/authorization check — auth bypass / privilege escalation.` });
     }
-    if (!hasNonce) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `AJAX handler '${handler}()' does not verify a nonce (wp_verify_nonce / check_ajax_referer) — CSRF.` });
+    if (!hasNonce && dangerous) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `AJAX handler '${handler}()' performs a state-changing operation without nonce verification (wp_verify_nonce / check_ajax_referer) — CSRF.` });
     }
   }
   const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
@@ -56514,20 +56523,27 @@ function detectWpAuthz(code, file, out) {
       continue;
     const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
     const hasNonce = NONCE_RE.test(body);
+    const dangerous = DANGEROUS_OP_RE.test(body);
     const line = lineNoOf(code, m.index);
-    if (nopriv && !hasCap) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated admin-post handler '${handler}()' has no authorization check — auth bypass / privilege escalation.` });
+    if (nopriv && !hasCap && dangerous) {
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated admin-post handler '${handler}()' performs a privileged/state-changing operation with no authorization check — auth bypass / privilege escalation.` });
     }
-    if (!hasNonce) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `admin-post handler '${handler}()' does not verify a nonce — CSRF.` });
+    if (!hasNonce && dangerous) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `admin-post handler '${handler}()' performs a state-changing operation without nonce verification — CSRF.` });
     }
   }
   const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
   while ((m = restRe.exec(code)) !== null) {
     const line = lineNoOf(code, m.index);
     const window2 = code.slice(m.index, m.index + 800);
-    if (/permission_callback/.test(window2))
+    const pc = window2.match(/permission_callback['"]?\s*=>\s*(.+?)(?:,|\s*\n|\])/);
+    if (pc) {
+      const expr = pc[1].trim();
+      if (/__return_true/.test(expr)) {
+        out.push({ file, line, type: "missing_authz", category: "REST route explicitly public (__return_true)", severity: "medium", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' sets permission_callback to __return_true (always allow) — verify the endpoint does not expose sensitive data or perform privileged actions.` });
+      }
       continue;
+    }
     out.push({ file, line, type: "missing_authz", category: "REST route missing permission_callback", severity: "high", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass).` });
   }
   const formRe = /add_action\s*\(\s*['"](init|admin_init|wp_loaded|template_redirect|parse_request|wp)['"]\s*,\s*(.+?)\s*\)/g;
@@ -56543,11 +56559,12 @@ function detectWpAuthz(code, file, out) {
       continue;
     const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
     const hasNonce = NONCE_RE.test(body);
+    const dangerous = DANGEROUS_OP_RE.test(body);
     const line = lineNoOf(code, m.index);
-    if (!hasNonce) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification (direct request handler)", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') reads request input without nonce verification — CSRF.` });
+    if (!hasNonce && dangerous) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification (direct request handler)", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a state-changing operation without nonce verification — CSRF.` });
     }
-    if (!hasCap && /(update_option|add_option|delete_option|wp_insert_post|wp_update_post|wp_delete_post|update_user_meta|delete_user_meta|wp_set_current_user|wp_mail|wp_handle_upload|move_uploaded_file|wp_delete_user|add_user|wp_create_user|set_user_role|wp_redirect\s*\(\s*['"]admin)/.test(body)) {
+    if (!hasCap && dangerous) {
       out.push({ file, line, type: "missing_authz", category: "Missing capability check (direct request handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a privileged/state-changing operation with no capability check — auth bypass / privilege escalation.` });
     }
   }
@@ -57949,7 +57966,7 @@ var ENTERPRISE_FIXTURES = [
   { id: "js-express", dir: join18(ROOT6, "js-express"), expected_vulns: 2 },
   { id: "py-django", dir: join18(ROOT6, "py-django"), expected_vulns: 2 },
   { id: "java-spring", dir: join18(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join18(ROOT6, "wp-batch-route"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join18(ROOT6, "wp-batch-route"), expected_vulns: 3 },
   { id: "php-complex", dir: join18(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.47",
+  "version": "2.4.49",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {